vexcalibur 0.1.0__tar.gz

vexcalibur-0.1.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

vexcalibur-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,292 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      run_scheduled_profile:
+        description: "Run the scheduled CI profile, including live external-service compatibility"
+        required: false
+        default: false
+        type: boolean
+      run_live_services:
+        description: "Run live external-service compatibility checks"
+        required: false
+        default: false
+        type: boolean
+  schedule:
+    - cron: "17 9 * * *"
+
+permissions:
+  contents: read
+
+env:
+  MAX_PYTHON: "3.14"
+  UV_CACHE_DIR: /tmp/vexcalibur-uv-cache
+  XDG_CACHE_HOME: /tmp/vexcalibur-cache
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ env.MAX_PYTHON }}
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Check lock file
+        run: uv lock --check
+
+      - name: Check formatting
+        run: uv run --frozen ruff format --check src tests scripts/*.py docs/conf.py
+
+      - name: Lint
+        run: uv run --frozen ruff check src tests scripts/*.py docs/conf.py
+
+      - name: Type check
+        run: uv run --frozen mypy src
+
+  workflow-lint:
+    name: Workflow lint
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install workflow tools
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: "v2026.6.12"
+          github_token: ""
+          cache: true
+          install_args: "actionlint shellcheck"
+
+      - name: Lint workflows
+        run: actionlint -shellcheck shellcheck .github/workflows/*.yml
+
+      - name: Lint shell scripts
+        run: shellcheck scripts/*.sh
+
+  security:
+    name: Repository security
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ env.MAX_PYTHON }}
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Audit Python dependencies
+        run: uv run --frozen pip-audit --cache-dir /tmp/vexcalibur-pip-audit-cache
+
+      - name: Scan pull request for secrets
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "/repos/${GITHUB_REPOSITORY}/contents/.secrets.baseline?ref=${BASE_SHA}" --jq .content \
+            | base64 --decode > /tmp/base.secrets.baseline
+          git ls-files -z | xargs -0 uv run --frozen detect-secrets-hook --baseline /tmp/base.secrets.baseline --
+
+      - name: Scan pushed code for secrets
+        if: github.event_name != 'pull_request'
+        run: git ls-files -z | xargs -0 uv run --frozen detect-secrets-hook --baseline .secrets.baseline --
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run offline tests
+        run: uv run --frozen pytest -m "not live" --cov-fail-under=75
+
+      - name: Upload coverage XML
+        if: matrix.python-version == env.MAX_PYTHON
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          retention-days: 14
+
+  build:
+    name: Build package
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ env.MAX_PYTHON }}
+
+      - name: Build distributions
+        run: uv build --clear --no-create-gitignore --no-sources
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          retention-days: 14
+
+  installed-cli:
+    name: Installed CLI
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ env.MAX_PYTHON }}
+
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist
+
+      - name: Select wheel
+        id: wheel
+        run: |
+          mapfile -t wheels < <(find dist -maxdepth 1 -type f -name "*.whl" | sort)
+          if [ "${#wheels[@]}" -ne 1 ]; then
+            echo "Expected exactly one wheel in dist, found ${#wheels[@]}" >&2
+            exit 2
+          fi
+          printf 'path=%s\n' "${wheels[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: Run installed CLI checks
+        env:
+          VEXCALIBUR_WHEEL: ${{ steps.wheel.outputs.path }}
+        run: make installed-cli-check
+
+  docs:
+    name: Build docs
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra docs
+
+      - name: Build documentation
+        run: make docs
+
+  live-services:
+    name: Live external-service compatibility
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && (inputs.run_scheduled_profile || inputs.run_live_services))
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: ${{ env.MAX_PYTHON }}
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run live external-service compatibility tests
+        run: uv run --frozen pytest -m live -q
+
+  ci:
+    name: CI result
+    runs-on: ubuntu-latest
+    needs: [quality, workflow-lint, security, test, build, installed-cli, docs]
+    if: always() && github.event_name != 'schedule' && !(github.event_name == 'workflow_dispatch' && inputs.run_scheduled_profile)
+    steps:
+      - name: Check required jobs
+        run: |
+          for result in "${{ needs.quality.result }}" "${{ needs.workflow-lint.result }}" "${{ needs.security.result }}" "${{ needs.test.result }}" "${{ needs.build.result }}" "${{ needs.installed-cli.result }}" "${{ needs.docs.result }}"; do
+            if [ "$result" != "success" ]; then
+              echo "Required job failed or was skipped: $result"
+              exit 1
+            fi
+          done

vexcalibur-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "41 8 * * 1"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          category: /language:python
+

vexcalibur-0.1.0/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          comment-summary-in-pr: always
+          fail-on-severity: high

vexcalibur-0.1.0/.github/workflows/pages.yml

@@ -0,0 +1,77 @@
+name: Publish documentation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/pages.yml"
+      - ".tool-versions"
+      - "Makefile"
+      - "docs/**"
+      - "pyproject.toml"
+      - "src/**"
+      - "uv.lock"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+env:
+  UV_CACHE_DIR: /tmp/vexcalibur-uv-cache
+
+jobs:
+  build:
+    name: Build documentation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: "3.13"
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra docs
+
+      - name: Build documentation
+        run: |
+          make docs
+          touch docs/_build/html/.nojekyll
+
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        with:
+          path: docs/_build/html
+
+  deploy:
+    name: Deploy documentation
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

vexcalibur-0.1.0/.github/workflows/pre-commit.yml

@@ -0,0 +1,43 @@
+name: Pre-commit
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  UV_CACHE_DIR: /tmp/vexcalibur-uv-cache
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version-file: .tool-versions
+          enable-cache: true
+          python-version: "3.14"
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run pre-commit
+        run: uv run --frozen pre-commit run --all-files
+
+      - name: Fail if hooks changed files
+        run: |
+          if ! git diff --quiet; then
+            git status --short
+            exit 1
+          fi